HIGH7.5
Уязвимость почтового сервера Cyrus IMAP и операционных систем openSUSE и OpenSUSE Leap, позволяющая нарушителю получить конфиденциальную информацию или оказать другое воздействие
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
ALT-PU-2015-1613-1Package update cyrus-imapd in branch t7
Severity:
Closed issues (6)
HIGH7.5
Уязвимость почтового сервера Cyrus IMAP и операционных систем openSUSE и OpenSUSE Leap, позволяющая нарушителю нарушить целостность и доступность защищаемой информации
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
MEDIUM5.8
Уязвимость почтового сервера Cyrus IMAP и операционных систем openSUSE и OpenSUSE Leap, позволяющая нарушителю нарушить целостность и доступность защищаемой информации
CVSS 2.0MEDIUM 5.8
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:PReferences
HIGH7.5
The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00037.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00038.html
- http://www.openwall.com/lists/oss-security/2015/09/29/2
- http://www.openwall.com/lists/oss-security/2015/09/30/3
- http://www.openwall.com/lists/oss-security/2015/11/04/3
- https://cyrus.foundation/cyrus-imapd/commit/?id=07de4ff1bf2fa340b9d77b8e7de8d43d47a33921
- https://cyrus.foundation/cyrus-imapd/commit/?id=c21e179c1f6b968fe69bebe079176714e511587b
- https://docs.cyrus.foundation/imap/release-notes/2.3/x/2.3.19.html
- https://docs.cyrus.foundation/imap/release-notes/2.4/x/2.4.18.html
- https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.4.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00037.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00038.html
- http://www.openwall.com/lists/oss-security/2015/09/29/2
- http://www.openwall.com/lists/oss-security/2015/09/30/3
- http://www.openwall.com/lists/oss-security/2015/11/04/3
- https://cyrus.foundation/cyrus-imapd/commit/?id=07de4ff1bf2fa340b9d77b8e7de8d43d47a33921
- https://cyrus.foundation/cyrus-imapd/commit/?id=c21e179c1f6b968fe69bebe079176714e511587b
- https://docs.cyrus.foundation/imap/release-notes/2.3/x/2.3.19.html
- https://docs.cyrus.foundation/imap/release-notes/2.4/x/2.4.18.html
- https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.4.html
HIGH7.5
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00015.html
- http://www.openwall.com/lists/oss-security/2015/09/30/3
- http://www.openwall.com/lists/oss-security/2015/11/04/3
- http://www.securitytracker.com/id/1034282
- https://cyrus.foundation/cyrus-imapd/commit/?id=745e161c834f1eb6d62fc14477f51dae799e1e08
- https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html
- https://lists.andrew.cmu.edu/pipermail/cyrus-devel/2015-October/003534.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00015.html
- http://www.openwall.com/lists/oss-security/2015/09/30/3
- http://www.openwall.com/lists/oss-security/2015/11/04/3
- http://www.securitytracker.com/id/1034282
- https://cyrus.foundation/cyrus-imapd/commit/?id=745e161c834f1eb6d62fc14477f51dae799e1e08
- https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html
- https://lists.andrew.cmu.edu/pipermail/cyrus-devel/2015-October/003534.html
HIGH7.5
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.html
- http://www.openwall.com/lists/oss-security/2015/11/04/3
- http://www.securitytracker.com/id/1034282
- https://cyrus.foundation/cyrus-imapd/commit/?id=6fb6a272171f49c79ba6ab7c6403eb25b39ec1b2
- https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.html
- http://www.openwall.com/lists/oss-security/2015/11/04/3
- http://www.securitytracker.com/id/1034282
- https://cyrus.foundation/cyrus-imapd/commit/?id=6fb6a272171f49c79ba6ab7c6403eb25b39ec1b2
- https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html